Analysis
- max time kernel
120s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
16/06/2024, 01:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
acb615b72532d8020f1fa9afa65c44bd67caa1ec83f39f4b029287e70c344d0b.exe
Resource
win7-20240611-en
windows7-x64
18 signatures
150 seconds
General
- Target acb615b72532d8020f1fa9afa65c44bd67caa1ec83f39f4b029287e70c344d0b.exe
- Size 1.3MB
- Sample240616-brndxatcnc
- SHA256 acb615b72532d8020f1fa9afa65c44bd67caa1ec83f39f4b029287e70c344d0b
- MD5 ee89f7922a4ccc1147e7c427c832a35a
- SHA1 573708eaf5ea90720c55c54e0dba672a18bc0d32
- SHA512 3db6f6e3dffef493c7257031fa03ad2beb7630e3ab36ef11464ab3a9c67abaebc37b949b0f73cc73827f05064db48745543fc0449a69345c9fe2a5b63e837fbb
- SSDEEP 24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNB:QHPkVOBTK
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2708-0-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit - Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/2708-0-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat - Detects executables calling ClearMyTracksByProcess 1 IoCs
resource yara_rule behavioral2/memory/2708-0-0x0000000010000000-0x000000001019F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys Phija.exe - Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Phija.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation acb615b72532d8020f1fa9afa65c44bd67caa1ec83f39f4b029287e70c344d0b.exe - Executes dropped EXE 1 IoCs
pid Process 3156 Phija.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: Phija.exe File opened (read-only) \??\J: Phija.exe File opened (read-only) \??\K: Phija.exe File opened (read-only) \??\O: Phija.exe File opened (read-only) \??\X: Phija.exe File opened (read-only) \??\G: Phija.exe File opened (read-only) \??\M: Phija.exe File opened (read-only) \??\N: Phija.exe File opened (read-only) \??\P: Phija.exe File opened (read-only) \??\S: Phija.exe File opened (read-only) \??\U: Phija.exe File opened (read-only) \??\Z: Phija.exe File opened (read-only) \??\B: Phija.exe File opened (read-only) \??\H: Phija.exe File opened (read-only) \??\L: Phija.exe File opened (read-only) \??\R: Phija.exe File opened (read-only) \??\Y: Phija.exe File opened (read-only) \??\E: Phija.exe File opened (read-only) \??\Q: Phija.exe File opened (read-only) \??\T: Phija.exe File opened (read-only) \??\V: Phija.exe File opened (read-only) \??\W: Phija.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Phija.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Phija.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 1620 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe 3156 Phija.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 3156 Phija.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2708 acb615b72532d8020f1fa9afa65c44bd67caa1ec83f39f4b029287e70c344d0b.exe Token: SeLoadDriverPrivilege 3156 Phija.exe Token: 33 3156 Phija.exe Token: SeIncBasePriorityPrivilege 3156 Phija.exe Token: 33 3156 Phija.exe Token: SeIncBasePriorityPrivilege 3156 Phija.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2708 wrote to memory of 3156 2708 acb615b72532d8020f1fa9afa65c44bd67caa1ec83f39f4b029287e70c344d0b.exe 81 PID 2708 wrote to memory of 3156 2708 acb615b72532d8020f1fa9afa65c44bd67caa1ec83f39f4b029287e70c344d0b.exe 81 PID 2708 wrote to memory of 3156 2708 acb615b72532d8020f1fa9afa65c44bd67caa1ec83f39f4b029287e70c344d0b.exe 81 PID 2708 wrote to memory of 4392 2708 acb615b72532d8020f1fa9afa65c44bd67caa1ec83f39f4b029287e70c344d0b.exe 82 PID 2708 wrote to memory of 4392 2708 acb615b72532d8020f1fa9afa65c44bd67caa1ec83f39f4b029287e70c344d0b.exe 82 PID 2708 wrote to memory of 4392 2708 acb615b72532d8020f1fa9afa65c44bd67caa1ec83f39f4b029287e70c344d0b.exe 82 PID 4392 wrote to memory of 1620 4392 cmd.exe 84 PID 4392 wrote to memory of 1620 4392 cmd.exe 84 PID 4392 wrote to memory of 1620 4392 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\acb615b72532d8020f1fa9afa65c44bd67caa1ec83f39f4b029287e70c344d0b.exe"C:\Users\Admin\AppData\Local\Temp\acb615b72532d8020f1fa9afa65c44bd67caa1ec83f39f4b029287e70c344d0b.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Phija.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Phija.exe"2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\ACB615~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:1620
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Phija.exe
- Size 1.3MB
- SHA256 acb615b72532d8020f1fa9afa65c44bd67caa1ec83f39f4b029287e70c344d0b
- MD5 ee89f7922a4ccc1147e7c427c832a35a
- SHA1 573708eaf5ea90720c55c54e0dba672a18bc0d32
- SHA512 3db6f6e3dffef493c7257031fa03ad2beb7630e3ab36ef11464ab3a9c67abaebc37b949b0f73cc73827f05064db48745543fc0449a69345c9fe2a5b63e837fbb
- SSDEEP 24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNB:QHPkVOBTK
- MD5 SHA1 SHA512 SSDEEP